Email transition

oc	#1 2009-01-31 07:18
Contributors Thanked: 1 time	So, the idea is, let everybody change their emails, but prevent security flaws by making reactivation on email change mandatory. Process is, if user is able to change his/her email (still with the option from administration/users) and if he changes his email, an activation email is being send, and this way email's validity is checked, and one mail/one user policy is remain safe. Already coded and imported the language stuff, but because of the "no enhancement after Jan 25" it is N-0.1.0 feature. (If not liked, sure will be cancelled) What do you think ? ~edit: so, code in, users.profile.inc.php, right after the code: $ruserbirthdate = ($rmonth==0 \|\| $rday ==0 \|\| $ryear==0) ? 0 : sed_mktime(1, 0, 0, $rmonth, $rday, $ryear); if (!$cfg['useremailchange']) { $ruseremail = $urr['user_email']; } http://www.cotonti.com/pastebin/8 Same on that file, change the whole $profile_form_email with: $profile_form_email = ($cfg['useremailchange']) ? "<input type=\"text\" class=\"text\" name=\"ruseremail\" value=\"".sed_cc($urr['user_email'])."\" size=\"32\" maxlength=\"64\" />" : "<input type=\"text\" class=\"text\" name=\"ruseremail\" value=\"".sed_cc($urr['user_email'])."\" size=\"32\" maxlength=\"64\" disabled=\"disabled\" />"; And in users.register.inc.php, change whole 'validate' part with: http://www.cotonti.com/pastebin/9 And of course, last, add after {USERS_PROFILE_EMAIL}: <div style="font-size: xx-small;">{PHP.skinlang.usersprofile.Emailnotes}</div> Not the perfect usage of new Pastebin but I wanted you to see code and bug fix it, and to keep the code here safely.
This post was edited by oc (2009-01-31 07:56, 15 years ago)

#1 2009-01-31 07:18

So, the idea is, let everybody change their emails, but prevent security flaws by making reactivation on email change mandatory.

Process is, if user is able to change his/her email (still with the option from administration/users) and if he changes his email, an activation email is being send, and this way email's validity is checked, and one mail/one user policy is remain safe.

Already coded and imported the language stuff, but because of the "no enhancement after Jan 25" it is N-0.1.0 feature. (If not liked, sure will be cancelled)

What do you think ?

~edit: so, code in, users.profile.inc.php, right after the code:

		$ruserbirthdate = ($rmonth==0 || $rday ==0 || $ryear==0) ? 0 : sed_mktime(1, 0, 0, $rmonth, $rday, $ryear);

		if (!$cfg['useremailchange'])
			{ $ruseremail = $urr['user_email']; }

http://www.cotonti.com/pastebin/8

Same on that file, change the whole $profile_form_email with:

$profile_form_email = ($cfg['useremailchange']) ? "<input type=\"text\" class=\"text\" name=\"ruseremail\" value=\"".sed_cc($urr['user_email'])."\" size=\"32\" maxlength=\"64\" />" : "<input type=\"text\" class=\"text\" name=\"ruseremail\" value=\"".sed_cc($urr['user_email'])."\" size=\"32\" maxlength=\"64\" disabled=\"disabled\" />";

And in users.register.inc.php, change whole 'validate' part with:
http://www.cotonti.com/pastebin/9

And of course, last, add after {USERS_PROFILE_EMAIL}:

					<div style="font-size: xx-small;">{PHP.skinlang.usersprofile.Emailnotes}</div>

Not the perfect usage of new Pastebin but I wanted you to see code and bug fix it, and to keep the code here safely.

This post was edited by oc (2009-01-31 07:56, 15 years ago)

Kilandor	#2 2009-01-31 10:43
Administrators Thanked: 9 times	Sounds fine to me, But what if they type the email wrong, then there account is locked out and they can't do anything. I think the proper way it should be done is, it sends the email to the current email address in the DB, and it doesn't instantly change it. Also, I don't think there is any reason to change the group That way say someone steals your account the email change request goes to you, and not the person trying to steal your account. And cool you used my pastebin :)

Kilandor

#2 2009-01-31 10:43

Administrators
Thanked: 9 times

Sounds fine to me, But what if they type the email wrong, then there account is locked out and they can't do anything. I think the proper way it should be done is, it sends the email to the current email address in the DB, and it doesn't instantly change it. Also, I don't think there is any reason to change the group
That way say someone steals your account the email change request goes to you, and not the person trying to steal your account.

And cool you used my pastebin :)

Brock	#3 2009-01-31 23:24
Contributors Thanked: 1 time	Kilandor's way makes sense, but what happens in the case of you wanting to change your email due to the fact your old email is no longer valid? Web Design Database - www.wddb.com

oc	#4 2009-01-31 23:28
Contributors Thanked: 1 time	(I posted before seeing Brock's post) @Brock: Well, you are right. This is why my old method is better. I actually don't see no reason to take precautions after user/hacker is on the profile. Actually most of the systems doesn't have this method (I've never seen before for myself). And if user intends to change his/her email, after reading instructions and warnings he should be careful. Anyway, I coded two different methods, pick one. (Second one is not my favourite, but there are some features we can use even if we choose one (like no mail send if email checks on reg is off-same end) @Kilandor: You can't foresee what may happen if I go your way. I actually was not too happy with the recent hack, because I used "user session identifier" but it was a strict hack, I won't try and explain the reasons I changed user group, but this code may be better. So, forget all coded before, new code is: users.profile.inc.php Before the code: /* ============= / default: / ============= / break; http://www.cotonti.com/pastebin/10 After the code: $rusertheme = ($ruserskin != $row['user_skin']) ? $ruserskin : $rusertheme; http://www.cotonti.com/pastebin/11 After the code: $ruserbirthdate = ($rmonth==0 \|\| $rday ==0 \|\| $ryear==0) ? 0 : sed_mktime(1, 0, 0, $rmonth, $rday, $ryear); (replace the little string about 'email transition') http://www.cotonti.com/pastebin/12 Of course, the update sql part part would be like this now: user_email='".sed_sql_prep($ruseremail)."', Replaced with: $newmail $profile_form_email* and skin tags remain like my previous post, like I said these are actually notes for myself, not to forget how code was, It would be nice the new release to come out, not able to code sucks. Oh, I almost forgot, say hello to our little friend: ALTER TABLE sed_users ADD COLUMN user_newmail varchar(64) collate utf8_unicode_ci NOT NULL default '';
This post was edited by oc (2009-01-31 23:46, 15 years ago)

#4 2009-01-31 23:28

Contributors
Thanked: 1 time

(I posted before seeing Brock's post)

@Brock:
Well, you are right. This is why my old method is better. I actually don't see no reason to take precautions after user/hacker is on the profile. Actually most of the systems doesn't have this method (I've never seen before for myself). And if user intends to change his/her email, after reading instructions and warnings he should be careful.

Anyway, I coded two different methods, pick one. (Second one is not my favourite, but there are some features we can use even if we choose one (like no mail send if email checks on reg is off-same end)

@Kilandor:

You can't foresee what may happen if I go your way.

I actually was not too happy with the recent hack, because I used "user session identifier" but it was a strict hack, I won't try and explain the reasons I changed user group, but this code may be better.

So, forget all coded before, new code is:

users.profile.inc.php

Before the code:

	/* ============= */
	default:
	/* ============= */

	break;

http://www.cotonti.com/pastebin/10

After the code:

	$rusertheme = ($ruserskin != $row['user_skin']) ? $ruserskin : $rusertheme;

http://www.cotonti.com/pastebin/11

After the code:

		$ruserbirthdate = ($rmonth==0 || $rday ==0 || $ryear==0) ? 0 : sed_mktime(1, 0, 0, $rmonth, $rday, $ryear);

(replace the little string about 'email transition')
http://www.cotonti.com/pastebin/12

Of course, the update sql part part would be like this now:

			user_email='".sed_sql_prep($ruseremail)."',

Replaced with:

$newmail

$profile_form_email and skin tags remain like my previous post, like I said these are actually notes for myself, not to forget how code was, It would be nice the new release to come out, not able to code sucks.

Oh, I almost forgot, say hello to our little friend:

ALTER TABLE sed_users ADD COLUMN user_newmail varchar(64) collate utf8_unicode_ci NOT NULL default '';

This post was edited by oc (2009-01-31 23:46, 15 years ago)

Trustmaster	#5 2009-02-01 03:00
Administrators Thanked: 263 times	Well, my 5 cents. I sometimes encounter these problems about emails: [list=1] Activation e-mails don't reach user mailboxes due to insane spam policies, which is no good. Usually have to re-register with another mailbox in this case. Sometimes you have to change email because the old mailbox is no longer valid, so it does no help if the activation email is sent to old box. Well, if you talk security, the problem is that if somebody has intercepted user's session, he can go to profile, change email and request password recovery for that email. And this way he steals the account completely. If all you want to avoid is this problem, I would advise just prompt for a password when user changes email. No complex coding, no extra database stuff. May the Source be with you!

Trustmaster

#5 2009-02-01 03:00

Administrators
Thanked: 263 times

Well, my 5 cents. I sometimes encounter these problems about emails:
[list=1]

Activation e-mails don't reach user mailboxes due to insane spam policies, which is no good. Usually have to re-register with another mailbox in this case.

Sometimes you have to change email because the old mailbox is no longer valid, so it does no help if the activation email is sent to old box.

Well, if you talk security, the problem is that if somebody has intercepted user's session, he can go to profile, change email and request password recovery for that email. And this way he steals the account completely. If all you want to avoid is this problem, I would advise just prompt for a password when user changes email. No complex coding, no extra database stuff.

May the Source be with you!

oc	#6 2009-02-01 03:30
Contributors Thanked: 1 time	It is not all about account security. It is also about site security. Email validation is something we can depend on in these situations.

Kilandor	#7 2009-02-01 03:32
Administrators Thanked: 9 times	Ah good idea man, I didn't think about password prompt to change email.

Trustmaster	#8 2009-02-01 05:16
Administrators Thanked: 263 times	To conclude it all, what we need to do is: [list=1] When changing email, prompt for password. Optional (set in Admin Config) email revalidation when changing email. Disagreed that email validation is something that puts bad guys away, though. It's not a problem to register a new mailbox for doing some harm May the Source be with you!

oc	#9 2009-02-01 18:39
Contributors Thanked: 1 time	After releasing the N-0.0.2, I'll handle this, I'm positive for password check, but email validation is good for security. If we are going to think that way, system will never be secure.

Trustmaster	#10 2009-02-01 20:32
Administrators Thanked: 263 times	Could you explain why it is so good? May the Source be with you!

m_ogz	#11 2009-02-02 05:18
Contributors	He things, he can track bad guys with their e-mails (I suppose). Ne hasta bekler sabahı, ne taze ölüyü mezar, ne de şeytan bir günahı, seni beklediğim kadar;<br /><br /> Geçti istemem gelmeni, yoklugunda buldum seni, bırak vehmimde gölgeni, gelme artık neye yarar...

oc	#12 2009-02-04 01:18
Contributors Thanked: 1 time	It is amazing that there is an actual plugin for this: http://www.neocrome.net/page.php?id=2070 I did not know about this, codes are not likely but it is really interesting that this has been done before exact method and nobody knows.

Dilster3000	#13 2009-02-04 01:21
Members	Well,the idea i going 50%,50% in my head....but i like it :)

Antar	#14 2009-02-04 01:47
Contributors	# oc : It is amazing that there is an actual plugin for this: http://www.neocrome.net/page.php?id=2070 I did not know about this, codes are not likely but it is really interesting that this has been done before exact method and nobody knows. I am using this at least 2 years